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PARTIAL SUPPORT OF MOBILITY BETWEEN 
RADIO ACCESS NETWORKS 

BACKGROUND 

[0001] This application is a continuation-in-part of United States Patent Application 
No. 09/268,471, Filed April 6, 1999, entitled "Inter-System Handover - Generic 
Handover Mechanism", which is incorporated herein by reference in its entirety. This 
application further claims the benefit and priority of the following (all of which are 
incorporated herein by reference in their entirety): United States Provisional Patent 
Application No. 60/268,065, filed February 13, 2001, entitled "Handover In A Shared 
Radio Access Network Environment Using Subscriber Dependent Neighbor Cell Lists"; 
United States Provisional Patent Application No. 60/301,442, filed June 29, 2001, 
entitled "Partial Support of Mobility Between Radio Access Networks". This 
application is related to the following (all of which are incorporated herein by reference 
in their entirety): United States Patent Application No. 09/932,447, filed August 20, 

2001, entitled "Transmission of Filtering/Filtered Information Over the Iur Interface"; 
United States Provisional Patent Application No. 60/330,708, filed October 29, 2001, 
entitled "Coordinated Subscriber Access Handling For Shared Network Support"; 

United States Patent Application No. (attorney docket: 2380-599), filed 

February 13, 2001, entitled "Handover In A Shared Radio Access Network 
Environment Using Subscriber Dependent Neighbor Cell Lists"; and, United States 
Patent Application No. (attorney docket 2380-604), filed February 13, 

2002, entitled "Coordinated Subscriber Access Handling For Shared Network Support". 

1. FIELD OF THE INVENTION 

[0002] The present invention pertains to wireless telecommunications, and particularly 
to roaming of a mobile user equipment unit (UE). 



2. RELATED ART AND OTHER CONSIDERATIONS 

[0003] In a typical cellular radio system, mobile user equipment units (UEs) 
communicate via a radio access network (RAN) to one or more core networks. The 
user equipment units (UEs) can be mobile stations such as mobile telephones 
("cellular" telephones) and laptops with mobile termination, and thus can be, for 
example, portable, pocket, hand-held, computer-included, or car-mounted mobile 
devices which communicate voice and/or data with radio access network. 

[0004] The radio access network (RAN) covers a geographical area which is divided 
into cell areas, with each cell area being served by a base station. A cell is a 
geographical area where radio coverage is provided by the radio base station equipment 
at a base station site. Each cell is identified, typically by a unique identity, which is 
broadcast in the cell. The base stations communicate over the air interface (e.g., radio 
frequencies) with the user equipment units (UE) within range of the base stations. In 
the radio access network, several base stations are typically connected (e.g., by 
landlines or microwave) to a radio network controller (RNC). The radio network 
controller, also sometimes termed a base station controller (BSC), supervises and 
coordinates various activities of the plural base stations connected thereto. The radio 
network controllers are typically connected to one or more core networks. 

[0005] One example of a radio access network is the Universal Mobile 
Telecommunications (UMTS) Terrestrial Radio Access Network (UTRAN). The 
UTRAN is a third generation system which is in some respects builds upon the radio 
access technology known as Global System for Mobile communications (GSM) 
developed in Europe. UTRAN is essentially a wideband code division multiple access 
(W-CDMA) system. An endeavor know as the Third Generation Partnership Project 
(3GPP) is seeking to evolve yet further the UTRAN. 

[0006] As those skilled in the art appreciate, in W-CDMA technology a common 
frequency band allows simultaneous communication between a user equipment unit 
(UE) and plural base stations. Signals occupying the common frequency band are 
discriminated at the receiving station through spread spectrum CDMA waveform 
properties based on the use of a high speed code, such as a pseudo-noise (PN) code. 
These high speed PN codes are used to modulate signals transmitted from the base 
stations and the user equipment units (UEs). Transmitter stations using different PN 
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codes (or a PN code offset in time) produce signals that can be separately demodulated 
at a receiving station. The high speed PN modulation also allows the receiving station 
to advantageously generate a received signal from a single transmitting station by 
combining several distinct propagation paths of the transmitted signal. In CDMA, 

5 therefore, a user equipment unit (UE) need not switch frequency when handoff of a 
connection is made from one cell to another. As a result, a destination cell can support 
a connection to a user equipment unit (UE) at the same time the origination cell 
continues to service the connection. Since the user equipment unit (UE) is always 
communicating through at least one cell during handover, there is no disruption to the 

10 call. Hence, the term "soft handover." In contrast to hard handover, soft handover is a 
"make-before-break" switching operation. 

[0007] The radio network controller (RNC) controls the UTRAN. In fulfilling its 
control role, the RNC manages resources of the UTRAN. Such resources managed by 
the RNC include (among others) the downlink (DL) power transmitted by the base 
15 stations; the uplink (UL) interference perceived by the base stations; and the hardware 
situated at the base stations. 

[0008] There are several interfaces of interest in the UTRAN. The interface between 
the radio network controllers (RNCs) and the core network(s) is termed the "Iu" 
interface. The interface between a radio network controller (RNC) and its base stations 

20 (BSs) is termed the 'Tub" interface. The interface between the user equipment unit 
(UE) and the base stations is known as the "air interface" or the "radio interface" or 
"Uu interface". In some instances, a radio connection involves both a Serving or 
Source RNC (SRNC) and a target or drift RNC (DRNC), with the SRNC controlling 
the radio connection but with one or more radio links of the radio connection being 

25 handling by the DRNC. An interface between radio network controllers (e.g., between 
a Serving RNC [SRNC] and a Drift RNC [DRNC]) is termed the "Iur" interface, and 
can be realized (for example) by an Inter-RNC transport link. 

[0009] Those skilled in the art appreciate that, with respect to a certain RAN-UE 
connection, an RNC can either have the role of a serving RNC (SRNC) or the role of a 
30 drift RNC (DRNC). If an RNC is a serving RNC (SRNC), the RNC is in charge of the 
radio connection with the user equipment unit (UE), e.g., it has full control of the radio 
connection within the radio access network (RAN). A serving RNC (SRNC) is 



connected to the core network. On the other hand, if an RNC is a drift RNC (DRNC), 
its supports the serving RNC (SRNC) by supplying radio resources (within the cells 
controlled by the drift RNC (DRNC)) needed for the radio connection with the user 
equipment unit (UE). A system which includes the drift radio network controller 
5 (DRNC) and the base stations controlled over the Iub Interface by the drift radio 
network controller (DRNC) is herein referenced as a DRNC subsystem or DRNS. 

[00010] When a radio connection between the radio access network (RAN) and user 
equipment unit (UE) is being established, the radio access network (RAN) decides 
which RNC is to be the serving RNC (SRNC) and, if needed, which RNC is to be a 

C310 drift RNC (DRNC). Normally, the RNC that controls the cell where the user equipment 

Pi 

£ unit (UE) is located when the radio connection is first established is initially selected as 
ffl the serving RNC (SRNC). As the user equipment unit (UE) moves, the radio 
r J connection is maintained even though the user equipment unit (UE) may move into a 
C3 new ce u ; possibly even a new cell controlled by another RNC. That other RNC 
rji5 becomes a drift RNCs (DRNC) for RAN-UE connection. An RNC is said to be the 
j = 2? Controlling RNC (CRNC) for the base stations connected to it by an Iub interface. This 
ff CRNC role is not UE specific. The CRNC is, among other things, responsible for 
=rt handling radio resource management for the cells in the base stations connected to it by 
the Iub interface. 

20 [0001 1] In certain situations it its advantageous to transfer control of a particular UE 
connection from one RNC to another RNC. Such a transfer of control of the UE 
connection from one RNC to another RNC has been referred to as soft RNC handover, 
SRNC moveover, and SRNC relocation. A relocate function/procedure is provided to 
effect this transfer of control. This is a general function/procedure covering UMTS 

25 internal relocations (e.g., relocation of SNRC within the UMTS) as well as relocations 
to other systems (e.g., from UMTS to GSM, for example). SRNC relocation is 
described in various references, including the following example commonly assigned 
patent applications (all of which are incorporated herein by reference): 
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[00012] (1) United States Patent Application Serial No. 09/035,821 filed March 6, 
1998, entitled "Telecommunications Inter-Exchange Measurement Transfer"; 



[00013] (2) United States Patent 6,233,222 entitled "Telecommunications Inter- 
Exchange Congestion Control"; 

[00014] (3) United States Patent 6,246,878 entitled "Multistage Diversity Handling 
For CDMA Mobile Telecommunications"; 

[00015] (4) United States Patent 6,230,013 entitled "Diversity Handling Moveover For 
CDMA Mobile Telecommunications"; 

[00016] (5) United States Patent Application Serial No. 09/732,877 filed December 11, 

2000, entitled "Control Node Handover In Radio Access Network"; 

[00017] (6) United States Patent Application Serial No. 09/543,536 filed April 5, 2000, 
entitled "Relocation of Serving Radio Network Controller With Signaling of Linking of 
Dedicated Transport Channels". 

[00018] (7) United States Patent Application Serial No. 09/829,001 filed April 10, 

2001, entitled "Connection Handling in SRNC Relocation". 

[00019] SRNC relocation is intended to make more efficient use of the transmission 
network. Once the former SRNC is not needed, the connection to the core network is 
moved and the connection between the two RNCs (the former SRNC and the former 
DRNC over the Inter-RNC link) is disconnected. 

[00020] For each mobile that the SRNC is serving, the SRNC stores a bit string which 
permanently identifies the mobile. According to the RAN system specified by the Third 
Generation Partnership Project (3GPP), this bit string is the IMSI, and is transferred to 
the SRNC from the CN using a Common ID procedure over the Iu interface at 
connection establishment. In the 3GPP approach, the structure of the IMSI is not 
recognized or used by the SRNC. It is only used to coordinate a paging from one CN 
domain with a connection that is ongoing for the other CN domain (matching two bit 
strings). The CRNC stores cell information for all cells which it controls. 

[00021] Currently the Third Generation Partnership Project (3GPP) envisions some 
cooperation between mobile network operators. It may be, for example, that two (or 
more) operators each have their respective operator networks (e.g., a public mobile 
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network network [PLMN]), and are cooperating in some parts of the coverage area (e.g. 
rural areas) but are competing in other areas (e.g. city areas). In the 3GPP parlance, the 
two networks are defined as "equivalent PLMNs" with regards to the cell selection 
process in a mobile terminal. This equivalence for cell selection enables the terminal to 
5 select cells of networks other than the operator's network to which the mobile terminal 
subscribes. 

[00022] For example, as illustrated in Fig. 1, a network of a first operator may have 
cells (illustrated by solid line circles in Fig. 1) serving or covering primarily a northern 
£ half of the country (e.g., below line L in Fig. 1), while a network of a second operator 
g 10 may have cells (illustrated by dotted line circles in Fig. 1) serving or covering primarily 
U a southern half of the country (e.g., below line L in Fig. 1). Further, both the first 
£3 operator and the second operator may serve a competition area (e.g., city) framed by 
| line C in Fig. 1 (e.g., both operators have cells in the city/metropolitan area). The first 
L and second operator should cooperate at least to the extent that the mobile terminal of a 
Fyi5 subscriber of the first operator who travels out of the first operator's network (e.g., 
g below line L) should be able to establish mobile communication using the cells of the 
h second operator, and vise versa, 
if 

[00023] Importantly, one of the operators (such as the first operator) may not wish for 
the mobile terminal subscribing to the other operator's network to use cells (e.g., of the 

20 first operator) in a region where the two operators have competing cells. For example, 
the first operator in Fig. 1 may not desire for a mobile terminal (UE), which subscribes 
to the subscription operators' network (e.g., the second operator's network in the case of 
Fig. 1) to use a cell of the first operator's network when the UE moves into the 
competition area C. Given the smaller cell size of the first operator's (solid line) cells in 

25 the competition area C of Fig. 1, and the greater number of cells provided by the first 
operator in the competition area C, the first operator likely may have invested 
considerably more in radio access network infrastructure that the second operator, 
providing better signal reception, traffic capacity, or coverage than the second operator. 
For these or other reasons, the first operator may wish to preclude the mobile terminal 

30 (which subscribes to the competing second operator's network) from using the (possibly 
superior) cells of the first operator, particularly since the second operator has provided 
competing cells in the same area. 



7 

[00024] For idle mode mobile terminals, the concept of "forbidden LA" (e.g., forbidden 
location area) results in rejection of access. When a mobile terminal is informed that a 
certain location area (LA) is forbidden, the mobile terminal has to find another LA (and 
will eventually select its own PLMN). Moreover, the mobile terminal also stores a list 
5 of forbidden LA which is used to avoid selecting a forbidden LA in the future when the 
mobile terminal is in its idle mode. 

[00025] Whereas access rejection is currently feasible for idle mode mobile terminals, 
presently there is no way to stop connected mode terminals belonging to a competitor's 
I- network from accessing cells in another network. What can happen, therefore, is that 
Ho (in the competition area) a first operator may invest extensively to provide quality 
CP coverage, while the competing second operator may try to save money by providing 
j-f poorer coverage, since the subscribers of the second operator's network can still reuse 
□ the coverage of the other first operator's network. Such considerations undermine both 
effective competition and cooperation. 

-15 [00026] What is needed, therefore, and an object of the present invention, is a 
ttl technique for precluding or rejecting accesses, in competition areas, to cells of a first 
=y operator's network attempted by or on behalf of a mobile terminal which subscribes to a 
second operator's network 

BRIEF SUMMARY 

20 [00027] Ordinarily a radio access network of an auxiliary (first) operator network has 
cells which are eligible for utilization by a user equipment unit (UE) which is in a 
connected mode and which subscribes to a subscription (second) operator's network. 
However, the present invention precludes or rejects attempted utilization (by a user 
equipment unit (UE) which subscribes to its subscription operator network) of a 

25 restricted cell, the restricted cell being any cell of the auxiliary operator network for 
which the subscription operator network has a competing cell. The rejected attempted 
utilization can be one of (1) handover to the restricted cell, and (2) cell/URA updating 
by the user equipment unit (UE) via the restricted cell. Further, preclusion of attempted 
utilization of the restricted cell occurs when the user equipment unit (UE) attempts cell 

30 reselection. Thus, in an example implementation, the rejection/preclusion encompasses 



the user equipment unit (UE) being in a connected mode in one of a cell_DCH state, a 
cell_FACH state, a cell_PCH state; a URA_PCH state; and a URA_PCH state. 

[00028] In its various aspects, the invention concerns a radio access network which 
performs a rejection necessary to protect the restricted cell, as well as a control node of 
such radio access network and a operator filter of such control node. 

[00029] When a handover is attempted toward a target cell of the auxiliary operator 
network with respect to the user equipment unit (UE) which subscribes to the 
subscription operator network, the protecting control node of the auxiliary operator 
network obtains, from an initiating operator's network, an international mobile 
subscriber identity (IMSI) of the user equipment unit (UE) and an identification of the 
target cell sought by the handover. The protecting control node uses the IMSI to 
determine whether the target cell is a restricted cell, and (if so) notifies the initiating 
operator's network that the handover is rejected. The international mobile subscriber 
identity (IMSI) of the user equipment unit (UE) and the identification of the target cell 
sought by the handover can be obtained from a source radio network controller (SRNC) 
of the initiating operator network. When the user equipment unit (UE) is in a cell_DCH 
state, in one illustrated embodiment the international mobile subscriber identity (IMSI) 
of the user equipment unit (UE) and the identification of the target cell are particularly 
obtained from a RL SETUP REQUEST message issued by the source radio network 
controller (SRNC) of the initiating operator network. In determining whether the target 
cell is a restricted cell, the protecting control node of the auxiliary operator network 
obtains a PLMN code from the IMSI of the user equipment unit (UE), and consults a 
table to determine (on the basis of the obtained PLMN code) whether the target cell is 
eligible for handover for the user equipment unit (UE). 

[00030] In addition to or in conjunction with an attempted handover, the second 
operator network can also attempt to perform a type of handover known as a hard 
handover with SRNC relocation, which (in the context of the present invention) is a 
transfer of a SRNC role from a radio network controller (RNC) of the subscription 
operator network to a radio network controller (RNC) of the auxiliary operator network. 
In such case, the protecting control node of the auxiliary operator network obtains the 
international mobile subscriber identity (IMSI) of the user equipment unit (UE) and an 
identification of the target cell from the core network. Then, the protecting control 
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node determines whether the target cell is a restricted cell (in like manner with the 
handover evaluation/rejection), and (if so) notifies the core network that the handover 
with relocation is rejected. In an illustrated implementation, the protecting control node 
obtains the international mobile subscriber identity (IMSI) of the user equipment unit 
5 (UE) and the identification of the target cell in a RELOCATION REQUEST message 
from the core network. 

[00031] The invention has wide applicability, regardless to which network the SRNC 
may be located (e.g., regardless of the identity of the initiating operator network). For 
J;' example, the source RNC can be within the subscription operator network. 
qio Alternatively, the source SRNC may be in the auxiliary (first) operator network (e.g., 
jjj; the procedures of the invention are used between two radio network controllers within 
O the auxiliary operator network). Yet further, the source SRNC may be in another 
S{ country (e.g., a third operator network), with the mobile terminal (UE) just moving into 
an area of the two cooperating/competing operator networks. 

ffj 

Qi5 [00032] The attempted utilization can also be an attempted cell update performed by 
P the user equipment unit (UE) via the restricted cell. Typically in performing a cell 
fU update the user equipment unit (UE) is in either a cellJFACH state or a cell_PCH state. 
When the user equipment unit (UE) attempts to perform a cell update to a target cell of 
the auxiliary operator network, the protecting control node also obtains, from the 
20 subscription operator network, the international mobile subscriber identity (IMSI) of 
the user equipment unit (UE) and the identification of the target cell. Then, in like 
manner with the attempted handover, the protecting control node determines whether 
the target cell is a restricted cell, and (if so) provides a notification that the cell update 
is rejected. In an example implementation, in conjunction with the attempted cell 
25 update the protecting control node receives the international mobile subscriber identity 
(IMSI) of the user equipment unit (UE) and the identification of the target cell from a 
COMMON TRANSPORT CHANNEL RESOURCES REQUEST message issued by 
the source radio network controller (SRNC) of the subscription operator network. 

[00033] Preclusion of attempted utilization of the restricted cell also occurs when the 
30 user equipment unit (UE) attempts cell reselection. Attempted cell reselection by the 
user equipment unit (UE) can occur, in an illustrated example embodiment, when the 
user equipment unit (UE) is in either a cell_PCH state, a cell_FACH state, or a 
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URA_PCH state. When there is an attempted utilization by the user equipment unit 
(UE) of the restricted cell, the auxiliary operator network prompts transmission of an 
identification of the restricted cell from the first operator network to the user equipment 
unit (UE). 

[00034] In one of its aspects, the present invention concerns a mobile terminal which 
subscribes to its native operator network and which, in a connected mode and prior to 
cell reselection to a target cell, checks whether the target cell is a restricted area. Here 
again the restricted area is considered as being both operated by the auxiliary or foreign 
operator network and competing with a cell operated by the native or subscription 
operator network. In an example implementation, the location area identity (LAI) 
broadcasted from each cell is used, and the mobile terminal maintains a list of restricted 
location area identities which is consulted as a part of the checking. In one example 
mode, the mobile terminal updates the list of restricted LAIs when the location 
registration to a core network via the restricted cell is rejected by the core network with 
information that this LAI is restricted. In another example mode, the mobile terminal 
updates the list of restricted LAIs when receiving a rejection of an attempted cell update 
(which includes information that this LAI is restricted). A further example is that the 
mobile terminal maintains a list of restricted cells, and upon rejection of cell update, is 
informed by the network that this particular cell is restricted. After a mobile terminal 
finds that a target cell is restricted, the mobile terminal no longer attempts to access that 
cell but instead searches for other cells. 



BRIEF DESCRIPTION OF THE DRAWINGS 

[00035] The foregoing and other objects, features, and advantages of the invention will 
be apparent from the following more particular description of preferred embodiments as 
illustrated in the accompanying drawings in which reference characters refer to the 
same parts throughout the various views. The drawings are not necessarily to scale, 
emphasis instead being placed upon illustrating the principles of the invention. 

[00036] Fig. 1 is a diagrammatic view showing network topology for illustrating a first 
scenario of the invention, the network topology including two operator networks 
(PLMNs) which in some geographical areas cooperate while in another geographical 
area compete. 
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[00037] Fig. 1A is a diagrammatic view showing network topology for illustrating a 
second scenario of the invention. 

[00038] Fig. IB is a diagrammatic view showing network topology for illustrating a 
third scenario of the invention 

[00039] Fig. 2 is a schematic view of portions of an example, representative 
telecommunications system which serve as an example, non-limiting implementation of 
embodiments of the present invention. 

[00040] Fig. 3 is a diagrammatic view showing various aspects of a user equipment 
unit (UE), together with certain basic aspects of a base station node and a radio network 
controller node. 

[00041] Fig. 4 is a diagrammatic view showing connected mode states of a user 
equipment unit (UE) pertinent to the present invention. 

[00042] Fig. 5A and Fig. 5B are partially schematic, partially diagrammatic views 
showing respective modes of solution components of the present invention for 
evaluating, and if necessary rejecting, a handover attempt. 

[00043] Fig. 6A(1), Fig. 6A(2), Fig. 6B(1), and Fig. 6B(2) are partially schematic, 
partially diagrammatic views showing respective modes of solution components of the 
present invention for , and if necessary rejecting, a cell update attempt. 

[00044] Fig. 7 is a schematic view of an example, representative RNC node which can 
be utilized with an implementation of the invention. 

[00045] Fig. 8 is a diagrammatic view showing storage of a copy of a CRNC's 
PLMN/area table at a SRNC node. 

DETAILED DESCRIPTION OF THE DRAWINGS 

[00046] In the following description, for purposes of explanation and not limitation, 
specific details are set forth such as particular architectures, interfaces, techniques, etc. 
in order to provide a thorough understanding of the present invention. However, it will 
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be apparent to those skilled in the art that the present invention may be practiced in 
other embodiments that depart from these specific details. In other instances, detailed 
descriptions of well known devices, circuits, and methods are omitted so as not to 
obscure the description of the present invention with unnecessary detail. Moreover, 
5 individual function blocks are shown in some of the figures. Those skilled in the art 
will appreciate that the functions may be implemented using individual hardware 
circuits, using software functioning in conjunction with a suitably programmed digital 
microprocessor or general purpose computer, using an application specific integrated 
circuit (ASIC), and/or using one or more digital signal processors (DSPs). 

JlO [00047] Returning to the illustration of Fig. 1, the first operator's network (depicted by 

m solid line cells) will be referred to as an auxiliary operator network (e.g., PLMN) while 

=~ the operator network depicted by dotted line cells will be referred to and considered a 

□ "subscription" operator network in the sense that, in the ensuing discussion, the mobile 
terminal involved in a connected mode is the subject of a subscription contract with the 

Si5 subscription network. As previously noted, as employed herein, the term "user 

q equipment unit (UE)" shall encompass all types of mobile terminals. 

=[j [00048] Outside of competition area C, the cells of the first (auxiliary) operator's 
network are eligible for utilization by a user equipment unit (UE) which is in a 
connected mode and which subscribes to its subscription operator's network. However, 

20 the present invention precludes or rejects attempted utilization of a restricted cell of the 
first operator's network by a user equipment unit (UE) which subscribes to another 
operator network (e.g., the subscription (second) operator's network). A restricted cell 
is any cell of the auxiliary operator network for which the subscription operator 
network has a competing cell, e.g., is in competition area C. As described in more 

25 detail hereinafter, the rejected attempted utilization can be one of (1) handover to the 
restricted cell, and (2) cell/URA updating by the user equipment unit (UE) via the 
restricted cell. Further, preclusion of attempted utilization of the restricted cell occurs 
when the user equipment unit (UE) attempts cell reselection. The rejection/preclusion 
thus encompasses the user equipment unit (UE) being in a connected mode in one of a 

30 cell_DCH state, a cell_FACH state, a cell_PCH state; and a URA_PCH state 

[00049] Before describing the inter-network competition/cooperation features of the 
present invention, a brief description of selected portions of an illustrative 
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implementation of an example radio access network is provided. The illustrative, non- 
limiting, example implementation is in the context of a universal mobile 
telecommunications (UMTS) 10 shown in Fig. 2. 

[00050] A representative, connection-oriented, external core network, shown as a 
cloud 12 of Fig. 2 may be for example the Public Switched Telephone Network (PSTN) 
and/or the Integrated Services Digital Network (ISDN). A representative, 
connectionless external core network shown as a cloud 14, may be for example the 
Internet. Both core networks are coupled to corresponding service nodes 16. The 
PSTN/ISDN connection-oriented network 12 is connected to a connection-oriented 
service node shown as a Mobile Switching Center (MSC) node 18 that provides circuit- 
switched services. The Internet connectionless-oriented network 14 is connected to a 
General Packet Radio Service (GPRS) node 20 tailored to provide packet-switched type 
services which is sometimes referred to as the serving GPRS service node (SGSN). 

[00051] Each of the core network service nodes 18 and 20 connects to a UMTS 
Terrestrial Radio Access Network (UTRAN) 24 over a radio access network (RAN) 
interface referred to as the Iu interface. UTRAN 24 includes one or more radio network 
controllers (RNCs) 26. For sake of simplicity, the UTRAN 24 of Fig. 1 is shown with 
only two RNC nodes, particularly RNC 26j and RNC 26 2 . Each RNC 26 is connected 
to a plurality of base stations (BS) 28. For example, and again for sake of simplicity, 
two base station nodes are shown connected to each RNC 26. In this regard, RNC 26 1 
serves base station 28 M and base station 2S U2 , while RNC 26 2 serves base station 28 2 _i 
and base station 28 2 _ 2 . It will be appreciated that a different number of base stations can 
be served by each RNC, and that RNCs need not serve the same number of base 
stations. Moreover, Fig. 2 shows that an RNC can be connected over an Iur interface to 
one or more other RNCs in the URAN 24. 

[00052] In the illustrated embodiments, for sake of simplicity each base station 28 is 
shown as serving one cell. Each cell is represented by a circle which surrounds the 
respective base station. It will be appreciated by those skilled in the art, however, that a 
base station may serve to communicate across the air interface for more than one cell. 
For example, two cells may utilize resources situated at the same base station site. 

[00053] A user equipment unit (UE), such as user equipment unit (UE) 30 shown in 
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Fig. 2, communicates with one or more cells or one or more base stations (BS) 28 over 
a radio or air interface 32. Each of the radio interface 32, the Iu interface, the Iub 
interface, and the Iur interface are shown by dash-dotted lines in Fig. 2. 

[00054] Preferably, radio access is based upon Wideband, Code Division Multiple 
Access (WCDMA) with individual radio channels allocated using CDMA spreading 
codes. Of course, other access methods may be employed. WCDMA provides wide 
bandwidth for multimedia services and other high transmission rate demands as well as 
robust features like diversity handoff and RAKE receivers to ensure high quality. In 
cell_DCH state, each user mobile station or equipment unit (UE) 30 is assigned its own 
scrambling code in order for a base station 28 to identify transmissions from that 
particular user equipment unit (UE) as well as for the user equipment unit (UE) to 
identify transmissions from the base station intended for that user equipment unit (UE) 
from all of the other transmissions and noise present in the same area. 

[00055] Different types of channels may exist between one of the base stations 28 and 
user equipment units (UEs) 30 for transport of control and user data. For example, in 
the forward or downlink direction, there are several types of broadcast channels 
including a general broadcast channel (BCH), a paging channel (PCH), a common pilot 
channel (CPICH), and a forward access channel (FACH) for providing various other 
types of control messages to user equipment units (UEs). The forward access channel 
(FACH) is also used to carry user data. In the reverse or uplink direction, a random 
access channel (RACH) is employed by user equipment units (UEs) whenever access is 
desired to perform location registration, call origination, page response, and other types 
of access operations. The random access channel (RACH) is also used for carrying 
certain user data, e.g., best effort packet data for, e.g., web browser applications. 
Dedicated channels (DCH) may be allocated to carry substantive call communications 
with a user equipment unit (UE). 

[00056] The present invention, which can be implemented in the example context of 
the telecommunications system of Fig. 2, particularly concerns a new and improved 
technique for fostering cooperation and competition between operator networks. As 
one of its aspects implementing this new technique, one or more of the radio network 
controllers 26 perform a network protecting function, and therefore are referenced 
herein as "protecting" nodes, or "protecting" control nodes. Accordingly, as an 
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illustrative, non-limiting example implementation, the radio network controllers 26 of 
Fig. 2 are shown as including a network protection filter 100. As described in more 
detail below, this protecting function, as implemented e.g., by network protection filter 
100, precludes or rejects attempted utilization of a restricted cell of the first (auxiliary) 
operator's network by the user equipment unit (UE) 30, assuming user equipment unit 
(UE) 30 subscribes to another operator network (e.g., the subscription (second) 
operator's network). 

[0001] Fig. 3 shows selected general aspects of user equipment unit (UE) 30 and 
illustrative nodes such as radio network controller 26 and base station 28. The user 
equipment unit (UE) 30 shown in Fig. 3 includes a data processing and control unit 31 
for controlling various operations required by the user equipment unit (UE). The UE's 
data processing and control unit 31 provides control signals as well as data to a radio 
transceiver 33 connected to an antenna 35. In addition to other functionalities herein 
after described, the user equipment unit (UE) 30 can have user-interactive or user- 
viewable devices, such as an input device 310 and a display device 312. 

[00057] The example radio network controller 26 and base station 28 as shown in 
Fig. 3 are radio network nodes that each include a corresponding data processing and 
control unit 36 and 37, respectively, for performing numerous radio and data processing 
operations required to conduct communications between the RNC 26 and the user 
equipment units (UEs) 30. Part of the equipment controlled by the base station data 
processing and control unit 37 includes plural radio transceivers 38 connected to one or 
more antennas 39. 

[00058] Fig. 7 illustrates, in somewhat more detail, an example non-limiting RNC node 
26 G of the present invention. RNC node 26 G of Fig. 7 can represent an serving RNC 
(SRNC) or a drift RNC (DRNC). It so happens that the RNC node 26 of Fig. 7 is a 
switched-based node having a switch 120. The switch 120 serves to interconnect other 
constituent elements of RNC node 26 G . Such other constituent elements include 
extension terminals [ETs] 125 G -i through 125 G . n , extension terminal 125i which 
connects RNC node 26 G via the inter-RNC link 29 to another radio network controller; 
and extension terminal 124. Extension terminals 125 G -i through 125 G . n essentially 
function to connect RNC node 26 G to the base stations 28 served by RNC node 26 G ; 
extension terminal 124 connects RNC node 26 across the Iu interface to the core 
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network 16. Yet other constituent elements of RNC node 26 G include diversity 
handover unit 27 G ; codex 130; timing unit 132; a data services application unit 134; 
and, a main processor 140. In the example non-limiting RNC node 26 G , the network 
protection filter 100 is shown as being implemented in main processor 140. However, 
it should be understood that network protection filter 100 can be implemented using 
individual hardware circuits, using software functioning in conjunction with a suitably 
programmed digital microprocessor or general purpose computer, using an application 
specific integrated circuit (ASIC), and/or using one or more digital signal processors 
(DSPs). 

[00059] The sample implementation of Fig. 2 thus serves as an example network, the 
architecture of which can be utilized by one or more of the auxiliary (first) operator's 
network and the subscription (second) operator's network. It should be understood, 
however, that such architectural example is not constraining to the present invention. 

[00060] As mentioned above, a problem is that the prior art does not offer any network 
protection with respect to a user equipment unit (UE) in its connected mode. The 
present invention overcomes this problem with three solution components. For the 
illustrated embodiments, these solution components are described briefly below in 
terms of 3GPP terminology. The 3GPP terminology subsumes an understanding of 
various states which can be acquired by a user equipment unit (UE) in its connected 
mode. Four of these states -- the cell_DCH state, the cell_FACH state, the URA_PCH 
state; and the cell_PCH state -- are germane to the present invention. These germane 
3GPP connection mode states illustrated in Fig. 4 and are each briefly described below. 
Each connected mode state reflects a different level of activity. 

[00061] The cellJDCH state is characterized in that there is a dedicated channel (DCH) 
assigned to the user equipment unit (UE). Macro-diversity may be used between DCHs 
of several cells. In the cell_DCH state, there is a dedicated control channel (DCCH) 
used for transmission of signalling messages between the user equipment unit (UE) and 
the UTRAN. 

[00062] In the cell_FACH state, no dedicated physical channel is assigned, but the user 
equipment unit (UE) listens continuously to a common channel (the FACH) in the 
downlink belonging to the selected cell. In the uplink, the user equipment unit (UE) 
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typically uses a random access channel (RACH). At each cell reselection, the user 
equipment unit (UE) updates the network with its current cell location. In this state, 
there is a dedicated control channel (DCCH) used for transmission of signalling 
messages between the user equipment unit (UE) and the UTRAN. The DCCH is 
implemented by appending the Radio Network Temporary Identity (U-RNTI or C- 
RNTI) to all signalling messages, and thus addressing an individual UE. The U-RNTI 
(UTRAN RNTI) is a global identity, which can be used in any cell in the UTRAN. The 
C-RNTI (Cell RNTI) is only significant in a single cell, and has to be reallocated in 
every cell. On the other hand, C-RNTI is much shorter than the U-RNTI which saves 
space over the radio interface when it is used. There is also a CCCH (Common control 
channel) in this state, which is used when the connection to the SRNC is not available, 
such at after cell reselection over RNC borders, when the CELL UPDATE or URA 
UPDATE message is sent to the DRNC. 

[00063] In the cell_PCH state, the user equipment unit (UE) monitors a paging channel 
(PCH) of a selected cell. On the PCH, the user equipment unit (UE) uses discontinuous 
reception (DRX) to save power, and the scheme for when to listen is agreed between 
the network and the user equipment unit (UE) on a per user equipment unit (UE) basis. 
Also in the cellJPCH state the user equipment unit (UE) updates the network with its 
current cell location at cell reselection. No DCCH is available in the cell_PCH state. 
On the PCH, means for addressing individual user equipment units (UEs) exist (using 
the U-RNTI), but the user equipment unit (UE) can not transport any signalling 
messages to the network. 

[00064] The URA_PCH state is almost identical to the cell_PCH state. The difference 
is that the user equipment unit (UE) does only update the network of its location after 
crossing URA borders. An URA (UTRAN Registration Area) is a group of cells. This 
means that in this state the position of the user equipment unit (UE) is in general known 
only on URA level. 

[00065] Having briefly described the connected mode states for a user equipment unit 
(UE), the solution components presented by the present invention are now introduced: 

[00066] (1) A first solution component is that a UE in cellJDCH state cannot be 
handed over to a cell of the competing network in the competition area. 
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[00067] (2) A second solution component is that the auxiliary (first) operator's network 
is able to reject accesses (cell update) from a UE in cell_FACH or cell_PCH state to a 
cell of the competitor network in the competition area. 

[00068] (3) A third solution component is that a UE in cell_FACH or cell_PCH state 
has functions which avoid selecting cells of the competitors network in the competition 
area, even though this network is considered "equivalent" from cell selection point of 
view. 

[00069] Each of these solution components is separately discussed below with 
illustrations such as Fig. 5A. In Fig. 5A and various ensuing illustrations, nodes of the 
auxiliary (first) operator's network are illustrated in solid lines, while nodes of the 
initiating operator's network are illustrated in broken lines. The initiating operator 
network is a network which requests a SRNS relocation or handover with relocation. 
Moreover, in these illustrations, any subscript including "Ol " refers to an aspect of the 
auxiliary (first) operator's network, while any subscript including "ON" refers to an 
aspect of the initiating operator's network. Furthermore, the radio network controller 
26 0 i of the auxiliary (first) operator's network is currently referred to as the CRNC, 
while the radio network controller 26 ON of the subscription (second) operator's network 
is currently designated as the SRNC. An inter-RNC link is shown as connecting the 
radio network controller 26 0 i of the auxiliary (first) operator's network and the radio 
network controller 26 0 n of the initiating operator's network. 

[00070] The invention has wide applicability, regardless to which network the radio 
network controller 26 0 n may belong or be located (e.g., regardless of the identity of the 
initiating operator network). For example, as in the situation shown in Fig. 1, the 
initiating operator network may be the subscription operator network, with the source 
SRNC therefore being within the subscription operator network. Alternatively, as 
shown in Fig. 1 A, the source SRNC may be in the auxiliary (first) operator network 
(e.g., the procedures of the invention are used between two radio network controllers 
within the auxiliary operator network). Yet further, as shown in Fig. IB, the source 
SRNC may belong to an initiating operator network in another country (e.g., the 
initiating operator network is a third operator network [not the auxiliary operator 
network or the subscription operator network]), with the mobile terminal (UE) just 
moving from the (foreign) initiating into an area of the two cooperating/competing 
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operator networks (the auxiliary operator network and the subscription operator 
network). Thus, it should be understood that the notation (e.g., subscript) "ON" as 
employed herein is not limited as referring to any particular initiating operator network, 
but can refer (for example) to the auxiliary operator network (e.g., ON = 01), to the 
subscription operator network, or to a third party or any other operator network. 

[00071] As previously mentioned, the radio network controller 26 0 i of the auxiliary 
(first) operator's network has network protection filter 100. As illustrated in Fig. 5 A 
and various subsequent drawings, network protection filter 100 includes a table 110 or 
other stored indication or list which is consulted to determine (on the basis of the 
obtained PLMN code) whether an action to be taken with respect to the target cell of 
the auxiliary (first) operator's network is permitted. 

[00072] The table 1 10 is also hereinafter known as the PLMN/area table 110. As will 
be apparent from subsequent description, under certain circumstances involved in the 
solution scenarios the network protection filter 100 of radio network controller 26 0 i of 
the auxiliary (first) operator's network is provided with the IMSI of the connected mode 
user equipment unit (UE) involved in a potential or attempted activity (e.g., handover, 
moveover, cell update), as well as an identification of the target cell. As understood by 
those skilled in the art, the IMSI is the international mobile subscriber identity, which is 
a unique identity allocated to each subscriber which facilitates correct subscriber 
identification over the radio path and through the network. The IMSI is usually a 
concatenation of mobile country code (MCC), mobile network code (MNC), and 
mobile station identification number (MSI). 

[00073] In the above regard, in various embodiments of the invention the network 
protection filter 100 obtains a PLMN code from the IMSI (e.g., a combination of the 
mobile country code [MCC] and the mobile network code [MNC]). The network 
protection filter 100 then consults the PLMN/area table 1 10 to determine whether the 
sought or attempted activity is to be permitted by the auxiliary (first) operator's 
network. For example, the network protection filter 100 uses the PLMN code as an 
index for accessing the PLMN/area table 1 10, and determines from the table 1 10 for 
which areas (e.g., cells) controlled by radio network controller 26 0 i of the auxiliary 
(first) operator's network the sought or attempted activity is permissible. The network 
protection filter 100 then searches the list of areas obtained from the table to determine 
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whether the target cell is listed or encompassed within the areas on the list. For 
example, in the illustration of Fig. 5A, the PLMN/area table 110 includes a list of 
permitted areas for which an activity with respect to a user equipment unit (UE) of the 
subscription (second) operator's network is permitted. 

5 [00074] Variations of the PLMN/area table 110 are, of course, possible. For example, 
the PLMN/area table 110 may list forbidden areas rather than permitted areas. In either 
case, the eligibility status of a cell can easily be obtained or inferred. 

[00075] The "areas" which are the subject of the table 1 10 (which may be either 
O permitted or forbidden) can be any conventional geographic or network-based unit, 
Sio such as cells or location areas (LAs). As those skilled in the art appreciate, a cell is a 
^ basic unit of a cellular system and is the geographic area where coverage is provided by 
p one base station. Location areas (LAs) are groups of cells, each location area having a 
u separate Location Area Identity (LAI). Base stations within a location area periodically 
□ broadcast the LAI for the particular location area in which they are situated. In the 
' : 15 event that the table 1 10 of network protection filter 100 is structured in terms of 
SB location area (LA), an optional subsidiary table 1 12 or the like may be utilized to look 
: f up a location area which includes the target cell (since it is the target cell which is 
communicated to the radio network controller 26 0] of the auxiliary (first) operator's 
network). At least in some embodiments herein described, all cells within a location 
20 area (LA) should uniformly be forbidden or uniformly accessible. 

[00076] REJECTING HANDOVER 

[00077] The first solution component is that a UE in cell_DCH state cannot be handed 
over to a cell of the competing network in the competition area. In essence, the radio 
network controller 26 0 i of the auxiliary (first) operator's network, which is the RNC 
25 which controls the target cell for the handover, is made in charge of deciding which 
UEs are allowed to access cells under its control. This provides the auxiliary (first) 
operator with consistent control over the resources used in the auxiliary (first) operator's 
network. 

[00078] Fig. 5A particularly illustrates certain basic events, actions, or steps which 
30 occur for one mode of the first solution scenario, e.g., a situation in which the 
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subscription operator network attempts to perform a handover to a target cell of the 
auxiliary operator network with respect to the user equipment unit (UE) which 
subscribes to the subscription operator network. The handover can be a soft handover, 
e.g., a handover in which the SRNC attempts to add a leg of the existing connection in 
the target cell. 

[00079] As shown by event 5A-1 in Fig. 5 A, radio network controller 26 0 i of the 
auxiliary (first) operator's network obtains, from the initiating operator network, the 
international mobile subscriber identity (IMSI) of the user equipment unit (UE) and an 
identification of the target cell sought by the handover. In a 3GPP implementation of 
this scenario, and assuming that the user equipment unit (UE) is in a cell_DCH state, 
the international mobile subscriber identity (IMSI) of the user equipment unit (UE) and 
the identification of the target cell are particularly obtained from a RL SETUP 
REQUEST message issued by radio network controller 26 0 n of the initiating operator's 
network. 

[00080] As event 5A-2, the protecting control node uses the IMSI to determine whether 
the target cell is a restricted cell (e.g., whether this user equipment unit (UE) is allowed 
access to the target cell). Usage of the IMSI for the determination is in the manner 
above described with reference to example PLMN/area table 110 (e.g., obtaining a 
PLMN code from the IMSI of the user equipment unit [UE], and consulting table 1 10 to 
determine [on the basis of the obtained PLMN code] whether the target cell is eligible 
for handover for the user equipment unit [UE]. If the access is not allowed, the radio 
network controller 26 0 i of the auxiliary (first) operator's network rejects the handover 
attempt (e.g., the RL SETUP REQUEST). As event 5A-3, the radio network controller 
26 0 i of the auxiliary (first) operator's network sends a message to radio network 
controller 26 0 n of the initiating operator's network, indicating that the target cell is not 
accessible for this subscriber (e.g., user equipment unit [UE]). 

[00081] Fig. 5B likewise illustrates certain basic events, actions, or steps which occur 
for another mode of the first solution scenario, e.g., a situation in which the subscription 
operator network attempts to perform a type of handover known as a handover with 
SRNS relocation is attempted. In the context of the present invention, such a moveover 
is a transfer of a SRNC role from radio network controller 26 ON of the initiating 
operator's network to radio network controller 26 Q i of the auxiliary (first) operator's 
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network. 

[00082] In the Fig. 5B scenario, as event 5B-1 radio network controller 26 0 n of the 
initiating operator's network initiates the SRNS relocation procedure by sending a 
relocation request message to core network(s) 16, the relocation request message 
5 including an identification of the target cell. Then, in response, as event 5B-2, the core 
network(s) 16 requests resources for the relocation in the target RNC (i.e., in radio 
network controller 26 0 i of the auxiliary (first) operator's network). The request 
resources message of event 5B-2 includes the IMSI of the user equipment unit (UE) as 
well as the identification of the target cell. 

10 [00083] In similar manner as in Fig. 5A, as event 5B-3 the target RNC (i.e., radio 
network controller 26 0 i of the auxiliary (first) operator's network) uses PLMN/area 
table 1 10 to determine whether this subscriber is allowed to access the target cell, and 
thus whether the relocation can be successful. In the event that the relocation is not 
allowed, the target radio network controller 26 0 i of the auxiliary (first) operator's 

15 network rejects the attempted relocation, issuing as event 5B-4 a message that the target 
cell is not accessible for this subscriber/user equipment unit (UE). In response, as event 
5B-5 the core network(s) 16 subsequently send a reject message to radio network 
controller 26 0 n of the initiating operator's network, such reject message also including 
a cause value or the like which explains that the target cell is not accessible for this 

20 subscriber/user equipment unit (UE). 

[00084] In one example implementation of Fig. 5B, the message of event 5B-1 is a 
RELOCATION REQUIRED message, while the message of event 5B-2 is a 
RELOCATION REQUEST message. 

[00085] REJECTING CELL UPDATE 

25 [00086] A second solution component is that the auxiliary (first) operator's network is 
able to reject accesses (cell updates and URA updates) from a UE in the competition 
area if the user equipment unit (UE) belongs to the subscription (second) operator's 
network. Cell updates can occur when the user equipment unit (UE) is in the 
cell_FACH or cell_PCH state; URA updates can occur when the user equipment unit 

30 (UE) is in the URA_PCH state. As used herein, "update" encompasses both cell update 



and URA update. 
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[00087] This second solution component incorporates similar principles as for the 
cell_DCH state (see the first solution, REJECTING HANDOVER, above), but applies 
when the connected mode user equipment unit (UE) is in the cell_FACH state, the 
cell_PCH state, or the URA_PCH state rather than in the cell_DCH state. For this 
second solution component, the same PLMN/area table 110 configured in network 
protection filter 100 of radio network controller 26 0 i of the auxiliary (first) operator's 
network is utilized. 

[00088] By way of background, when a user equipment unit (UE) is using the 
RACH/FACH common channels (e.g., UE RRC state is cell_FACH), the first message 
sent from the user equipment unit (UE) upon entering a new cell is a CELL-UPDATE 
RRC message. The CELL-UPDATE RRC message serves as a kind of registration 
message to let the UTRAN know the new position of the user equipment unit (UE). 
The UTRAN then decides how to handle this user equipment unit (UE). If UTRAN 
decides that the user equipment unit (UE) is to remain on common channels, the user 
equipment unit (UE) will be told to remain on common channels. The user equipment 
unit (UE) then monitors the FACH for any downlink transmission, and uses a certain 
RACH for uplink access. This case of the user equipment unit (UE) using common 
channels thus differs from a case of a user equipment unit (UE) using dedicated 
channels, since usage of dedicated channels may set up a soft handover situation in 
which new radio links or connection legs with the user equipment unit (UE) are 
established via the new cell. In analogous manner, URA updating can occur when the 
user equipment unit (UE) is in the URA_PCH state. As mentioned above, generic 
reference herein to "update" encompasses both/either a cell update scenario and URA 
update scenario, the signaling sequence being essentially the same for both. 

[00089] Various modes of the second solution component are illustrated in Fig. 6A(1), 
Fig. 6A(2), Fig. 6B(1), and Fig. 6B(2). This second solution component is generally 
applicable in a situation such as the following: The user equipment unit (UE) (which 
belongs to subscription (second) operator's network) has not yet learned that a certain 
area (e.g., cell or location area [LA]) is forbidden, and accordingly the user equipment 
unit (UE) attempts to perform an update (e.g., an update to a target cell of a LA). Event 
6-1 of Fig. 6A(1), Fig. 6A(2), Fig. 6B(1), and Fig. 6B(2) shows the user equipment unit 
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(UE) attempting an update toward radio network controller 26 Q i of the auxiliary (first) 
operator's network. The update message of event 6-1 does not include the IMSI of the 
subscriber (e.g., of the user equipment unit [UE]), so as event 6-2 the radio network 
controller 26 Q i of the auxiliary (first) operator's network can only include and forward 
5 the cell update message to radio network controller 26 Q n of the initiating operator's 
network as in normal operation. 

[00090] Upon receiving the update request of event 6-2, the radio network controller 
26 0 n of the initiating operator's network has two possible basic responses. A first 
possible response is to use Iur connection; a second possible response is to initiate an 
k 10 SRNS relocation. The communication of rejection to the user equipment unit (UE) can, 
y in both possible responses, be implemented in either of two alternatives. For both 
J possible basic responses, the first alternative involves sending a special rejection 
;5 message to the user equipment unit (UE). The second alternative involves using 
O another message which eventually has the effect of rejecting the cell update (e.g., a 
JU.15 RRC RELEASE message sent from the SRNC to the user equipment unit (UE), which 

FU causes the user equipment unit (UE) to attempt an unsuccessful location registration to 

m 

the core network(s) 16 and to realize that the cell is forbidden). 

E3 

ni 

[00091] The first alternative of the first possible response is illustrated in Fig. 6A(1), 
while the second alternative of the first possible response is illustrated in Fig. 6A(2). 
20 The first alternative of the second possible response is illustrated in Fig. 6B(1), while 
the second alternative of the second possible response is illustrated in Fig. 6B(2). 

[00092] Fig. 6A(1) illustrates the mode of the second solution component wherein the 
SRNC (i.e., radio network controller 26 0 n of the initiating operator's network) remains 
in the old network and the Iur connection is utilized. As event 6A-3, the radio network 

25 controller 26 0 n of the initiating operator's network sends a resource request message to 
radio network controller 26oi of the auxiliary (first) operator's network, the message of 
event 6A-3 including the target cell, as well as the IMSI of the subscriber. In an 
illustrated 3GPP-based example implementation, the message of event 6A-3 can be a 
COMMON TRANSPORT CHANNEL RESOURCES REQUEST message issued to 

30 the CRNC. (e.g., radio network controller 26 0 i of the auxiliary (first) operator's 
network). 
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[00093] As in previously described modes, as event 6A-4 the network protection filter 
100 of radio network controller 26 Q i of the auxiliary (first) operator's network uses 
PLMN/area table 1 10 to determine whether the user equipment unit (UE) is allowed 
access to the target cell. Should the user equipment unit (UE) not be allowed access, as 
event 6A-5 the radio network controller 26 0 i of the auxiliary (first) operator's network 
sends a reject message radio network controller 26 Q n of the initiating operator's 
network, advising that this cell is not accessible by the user equipment unit (UE). Then, 
as event 6A(l)-6, the radio network controller 26 G n of the initiating operator's network 
sends a reject message to user equipment unit (UE). 

[00094] In the first alternative of Fig. 6A(1), the reject message of event 6A(l)-6 is a 
message which specifically rejects the update (e.g., a message dedicated to the purpose 
of rejecting the update or specifically carrying a direct code, field, or value which is 
understood as a rejection). The message of event 6A(l)-6 specifically indicates that the 
cell/URA for which the update is requested belongs to a forbidden area (e.g., a 
forbidden location area or forbidden cell). In response, as event 6A(l)-7, the user 
equipment unit (UE) stores the cell which drew the rejection message on its forbidden 
area list 202 (see Fig. 3). The user equipment unit (UE) then tries to select another cell, 
and eventually will select a cell of the initiating operator's network or else enter its idle 
mode. 

[00095] Fig. 6A(2) illustrates the second alternative of implementing the Iur 
connection-utilizing mode of rejecting the update. For the Fig. 6A(2) scenario, events 
6-1 and 6-2, as well as events 6A-3 through 6A-5 are essentially the same as shown in 
Fig. 6A(1). However, the second alternative of Fig. 6A(2) differs in its manner of 
communicating the rejection of the update to user equipment unit (UE). Specifically, 
this second alternative of Fig. 6A(2) can occur when a new message for rejecting a 
update is not available or otherwise feasible in the auxiliary (first) operator's network. 
In the second alternative of Fig. 6A(2), the rejection message of event 6A(2)-6 is a 
RRC RELEASE message. Upon receipt of the RRC RELEASE message of event 
6A(2)-6, the user equipment unit (UE) enters the idle mode and attempts (as event 
6A(2)-7) a location registration to the core network(s) 16. This location registration 
goes through radio network controller 26 Q i of the auxiliary (first) operator's network (in 
the case of a cell update, for example), since the user equipment unit (UE) still believes 
that the target cell is a valid cell. The user equipment unit (UE) will only trigger this 
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location registration if the LAI of the new cell is different from before (which explains 
why the forbidden or restricted areas are preferably location areas [LAs]). 

[00096] The core network(s) 16, having the same information as in PLMN/area table 
1 10, will reject the attempted location registration of event 6A(2)-7, as indicated by the 
rejection message of event 6A(2)-8. The message of event 6A(2)-8 indicates that the 
cause of the rejection is a forbidden area (e.g., forbidden location area [LA]). Although 
not shown as such in Fig. 6A(2) for sake of simplification of the drawing, the location 
registration of event 6A(2)-7 and the rejection of event 6A(2)-8 are made via base 
station that serves the cell involved in the update was sought. Upon receipt of such 
rejection, as event 6A(2)-9 the user equipment unit (UE) updates its list of forbidden 
areas 202 (see Fig. 3). Eventually the user equipment unit (UE) will select another area 
(e.g., hopefully of the subscription operator's network) and perform a successful 
registration. 

[00097] Fig. 6B(1) illustrates the mode of the second solution component wherein the 
SRNC (i.e., radio network controller 26 Q n of the initiating operator's network) decides 
to use a handover with SRNC relocation. Fig. 6B(1) shows that the events 6-1 through 
6-2 of Fig. 6 have occurred in like manner as in Fig. 6A(1), with the result that radio 
network controller 26 0 i of the auxiliary (first) operator's network has sent to radio 
network controller 26 Q n of the initiating operator's network the update message 6-2. 
Then, as event 6B-3 radio network controller 26 Q n of the subscription (second) 
operator's network initiates the handover with SRNS relocation procedure by sending a 
relocation request message to core network(s) 16. The relocation request message 
includes an identification of the target cell. Then, in response, as event 6B-4, the core 
network(s) 16 request resources for the relocation in the target RNC (i.e., in radio 
network controller 26 0 i of the auxiliary (first) operator's network). The request 
resources message of event 6B-4 includes the IMSI of the user equipment unit (UE) as 
well as the identification of the target cell/URA. 

[00098] In similar manner with previous scenarios, as event 6B-5 the target RNC (i.e., 
radio network controller 26 01 of the auxiliary (first) operator's network) uses 
PLMN/area table 1 10 to determine whether this subscriber is allowed to access the 
target cell/URA, and thus whether the moveover can be successful. In the event that 
the relocation is not allowed, the target radio network controller 26 Q i of the auxiliary 
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(first) operator's network rejects the attempted relocation, issuing as event 6B-6 a 
message that the target cell is not accessible for this subscriber/user equipment unit 
(UE). In response, as event 6B-7 the core network(s) 16 subsequently send a reject 
message to radio network controller 26 Q n of the initiating operator' s network, such 
reject message also including a cause value or the like which explains that the target 
cell is not accessible for this subscriber/user equipment unit (UE). 

[00099] As in the first mode of the solution of rejecting updates, in the second mode 
the communication to user equipment unit (UE) of the rejection of the update can occur 
in either of two alternatives. The first alternative is illustrated in Fig. 6B(1), and is 
analogous to the Iur connection-utilizing communication of Fig. 6A(1). In this first 
alternative as event 6B(l)-8, the radio network controller 26 ON of the initiating 
operator's network sends a reject message to user equipment unit (UE). The reject 
message of event 6B(l)-8 is a message which specifically rejects the update (e.g., a 
message dedicated to the purpose of rejecting the update or specifically carrying a 
direct code, field, or value which is understood as a rejection). The message of event 
6B(l)-8 specifically indicates that the cell for which the update is requested belongs to 
a forbidden area (e.g., a forbidden location area or forbidden cell). In response, as 
event 6B(l)-9, the user equipment unit (UE) stores the cell which drew the rejection 
message on its forbidden area list 202 (see Fig. 3). The user equipment unit (UE) then 
tries to select another cell, and eventually will select another cell (e.g., a cell of the 
subscription operator's network or else enter its idle mode). 

[000100] The second alternative of the second mode of rejecting updates is 

illustrated in Fig. 6B(2). For the Fig. 6B(2) scenario, events 6-1 and 6-2, as well as 
events 6B-3 through 6B-7 are essentially the same as shown in Fig. 6B(1). However, 
like Fig. 6A(2), the second alternative of Fig. 6B(2) differs in its manner of 
communicating the rejection of the update to user equipment unit (UE). Specifically, 
this second alternative of Fig. 6B(2) can occur when a new message for rejecting an 
update is not available or otherwise feasible in the auxiliary (first) operator's network. 
In the second alternative of Fig. 6B(2), the rejection message of event 6B(2)-8 is a RRC 
RELEASE message. Upon receipt of the RRC RELEASE message of event 6B(2)-8, 
the user equipment unit (UE) enters the idle mode and attempts (as event 6B(2)-9) a 
location registration to the core network(s) 16. 



28 

[000101] The core network(s) 16, having the same information as in 

PLMN/area table 110, will reject the attempted location registration of event 6B(2)-9, 
as indicated by the rejection message of event 6B(2)-10. The message of event 6B(2)- 
10 indicates that the cause of the rejection is a forbidden area (e.g., forbidden location 
area [LA]). Although not shown as such in Fig. 6B(2) for sake of simplification of the 
drawing, the location registration of event 6B(2)-9 and the rejection of event 6B(2)-10 
are made via base station that serves the cell for which the update was sought. Upon 
receipt of such rejection, as event 6B(2)-11 the user equipment unit (UE) updates its list 
of forbidden areas 202 (see Fig. 3). Eventually the user equipment unit (UE) will select 
another area (e.g., hopefully an area of the subscription operator's network) and 
perform a successful registration. 

[000102] In example implementations of Fig. 6B(1) and Fig. 6B(2), the message of 
event 5B-1 is a RELOCATION REQUIRED message, while the message of event 5B-2 
is a RELOCATION REQUEST message. 

[000103] AVOIDING UE ACCESS TO FORBIDDEN CELLS 

[000104] The third solution component is that a user equipment unit (UE) in 
cell_FACH or cell_PCH state having functions which avoid selecting cells of the 
competitors network in the competition area, even though this network is considered 
"equivalent" from cell selection point of view. This third solution component thus 
concerns a situation in which the user equipment unit (UE) subscribes to its native 
operator network (e.g., the subscription (second) operator's network) and is in a 
connected mode, but attempts cell reselection to a target cell which is a restricted cell. 

[000105] As shown in Fig. 3, in accordance with the present invention, the user 
equipment unit (UE) has a network access filter function 200 which checks whether the 
target cell is a restricted cell. In an example implementation, the mobile terminal 
maintains a list of restricted areas (e.g., forbidden area list 202) which is consulted as 
part of the checking. The network access filter function 200 may be implemented using 
individual hardware circuits, using software functioning in conjunction with a suitably 
programmed digital microprocessor or general purpose computer, using an application 
specific integrated circuit (ASIC), and/or using one or more digital signal processors 
(DSPs). 
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[000106] Thus, in this third solution component, the network access filter function 200 
of the user equipment unit (UE) checks that the target cell is not part of an area (e.g, a 
location area [LA]) in the forbidden area list 202. In this checking, the UE does not 
indicate to higher layers mobility management any change of area (e.g., LA). The 
5 checking of the area (e.g., LA) in connected mode is only to determine if it is allowed 
to access the cell. 

[000107] In one implementation of the invention, the same list of forbidden areas that 
is used for idle mode can be used for the connected mode. 

□ [000108] The list of restricted areas 202 can be updated upon location registration to a 

JSio core network, as in the manner indicated in Fig. 5A(2) and Fig. 6A(2). Alternatively, 

P the list of restricted areas 202 can be updated upon receiving a rejection of an attempted 

5 cell update [e.g., in the manner indicated in Fig. 5A(1) and Fig. 6A(1)]. 

5 

q [000109] Fig. 8 shows that the source radio network controller (RNC) SRNC of the 
J initiating operator network may optionally store a copy 1 10' of the PLMN/area table 
njs 110 of the target RNC of the auxiliary operator network. With the table copy 1 10', the 
jfj source RNC of the initiating operator network can predict whether an access will be 

rejected or not. If, with the aid of the table copy 110', the source RNC of the initiating 
operator network predicts a rejection of an access, unnecessary signaling between the 
source SRNC and target RNC may be avoided. 

20 [0001 10] The present invention thus advantageously allows two operators, each having 
its own PLMN, to cooperate on coverage in some parts of the license area, whereas 
they can compete in other parts. In particular, the invention provides mechanisms to 
avoid and reject access of user equipment units (UEs) to cells to which the UE is not 
authorized to use resources. 

25 [0001 1 1] While the invention has been described in connection with what is presently 
considered to be the most practical and preferred embodiment, it is to be understood 
that the invention is not to be limited to the disclosed embodiment, but on the contrary, 
is intended to cover various modifications and equivalent arrangements included within 
the spirit and scope of the appended claims. 
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